‘Privacy does not happen on its own’: Report makes recommendations after mass student data breach

A man typing on a backlit computer keyboard. (Bloomberg Creative Photos/Bloomberg Creative)

A report from Alberta and Ontario Information and Privacy Commissioners says schools impacted by a data breach spanning the two provinces and areas in the U.S. were unprepared.

• The information you need to know, sent directly to you: Download the CTV News App

The breach involved PowerSchool education technology and affected millions of Canadians across the country, including 41 schools in Alberta.

Compromised data included names, phone numbers, birth dates and gender of students as well as information on medical and guardian records.

Multiple schools received extortion attempts stemming from the data breach, reported Alberta’s Office of the Information and Privacy Commissioner (OIPC) in May.

Alberta and Ontario’s joint report said educational bodies lacked policies and procedures to effectively monitor and oversee PowerSchool’s technical and security safeguards and failed to include privacy and security-related provisions in their contractual agreement.

Information and Privacy Commissioner of Alberta Diane McLeod said the risks to privacy caused by the breach were significant.

“It is essential to remember that privacy does not happen on its own. It requires a concerted effort by public bodies to create and implement policies and procedures that ensure privacy is protected,” said McLeod in a statement Tuesday.

Commissioners made several recommendations including a review and negotiation of agreements with PowerSchool, implementing effective monitoring and oversight, limiting remote access to student information systems and ensuring they have adequate policies and procedures in place to respond to breaches in the future.